Everything here seems to be working as expected. I suspect you have
additional access rules you didn't show us yet, which act before the
ones you present are evaluated. You should consider posting:
- the version of OpenLDAP you're using
- the complete slapd.conf
- a minimal LDIF containing the minimal database required for checking
- the exact command line (including LDIF data) that causes the error.